Crossplane v2 Preview

This is the first preview release of Crossplane v2! 🎉

Crossplane v2 makes Crossplane more useful, more intuitive, and less opinionated.

Crossplane v2 makes three major changes:

• Composite resources are now namespaced
• Managed resources are now namespaced
• Composition supports any Kubernetes resource

Crossplane v2 is better suited to building control planes for applications, not just infrastructure. It removes the need for awkward abstractions like claims and provider-kubernetes Objects.

Read the v2 preview documentation to get started with Crossplane v2.

Have thoughts or feedback on the Crossplane v2 preview? Leave a comment on the Crossplane v2 proposal pull request.

What's Changed

• [v2] Don't explicitly "unpublish" connection details by @negz in #6327
• [v2] Push v2 branch builds to https://charts.crossplane.io/preview by @negz in #6342
• [v2] Support namespaced extra resources by @negz in #6334
• [v2] Cleanup core flags by @negz in #6344
• [v2] Don't set composed resource meta.generateName if meta.name is set explicitly by @negz in #6346
• [v2] Add new Usage and ClusterUsage types in protection.crossplane.io by @negz in #6345
• Add v2alpha1 apiextensions to runtime scheme and xpkg parser/linter by @jbw976 in #6366

Full Changelog: v2.0.0-preview.0...v2.0.0-preview.1

This is a patch release scoped to fixing issues reported by users of Crossplane v1.19 and fixing security related issues in Crossplane's dependencies.

What's Changed

• chore(deps): update module github.com/go-jose/go-jose/v4 to v4.0.5 [security] (release-1.19) by @crossplane-renovate in #6299
• [Backport release-1.19] fix(crank): render private pull by @github-actions in #6326
• chore(deps): update module golang.org/x/oauth2 to v0.27.0 [security] (release-1.19) by @crossplane-renovate in #6315
• chore(deps): update module golang.org/x/crypto to v0.35.0 [security] (release-1.19) by @crossplane-renovate in #6314
• fix(deps): update module golang.org/x/net to v0.36.0 [security] (release-1.19) by @crossplane-renovate in #6332
• chore(deps): update module github.com/golang-jwt/jwt/v4 to v4.5.2 [security] (release-1.19) by @crossplane-renovate in #6357
• fix(deps): update module github.com/golang-jwt/jwt/v5 to v5.2.2 [security] (release-1.19) by @crossplane-renovate in #6358

Full Changelog: v1.19.0...v1.19.1

This is a patch release scoped to fixing issues reported by users of Crossplane v1.18 and fixing security related issues in Crossplane's dependencies.

What's Changed

• chore(deps): update module github.com/go-jose/go-jose/v4 to v4.0.5 [security] (release-1.18) by @crossplane-renovate in #6298
• chore(deps): update module golang.org/x/oauth2 to v0.27.0 [security] (release-1.18) by @crossplane-renovate in #6313
• chore(deps): update module golang.org/x/crypto to v0.35.0 [security] (release-1.18) by @crossplane-renovate in #6312
• fix(deps): update module golang.org/x/net to v0.36.0 [security] (release-1.18) by @crossplane-renovate in #6331
• chore(deps): update module github.com/golang-jwt/jwt/v4 to v4.5.2 [security] (release-1.18) by @crossplane-renovate in #6355
• fix(deps): update module github.com/golang-jwt/jwt/v5 to v5.2.2 [security] (release-1.18) by @crossplane-renovate in #6356

Full Changelog: v1.18.3...v1.18.4

This is a patch release scoped to fixing issues reported by users of Crossplane v1.17 and fixing security related issues in Crossplane's dependencies.

What's Changed

• chore(deps): update module golang.org/x/oauth2 to v0.27.0 [security] (release-1.17) by @crossplane-renovate in #6311
• chore(deps): update module golang.org/x/crypto to v0.35.0 [security] (release-1.17) by @crossplane-renovate in #6310
• fix(deps): update module golang.org/x/net to v0.36.0 [security] (release-1.17) by @crossplane-renovate in #6330
• chore(deps): update module github.com/golang-jwt/jwt/v4 to v4.5.2 [security] (release-1.17) by @crossplane-renovate in #6353
• fix(deps): update module github.com/golang-jwt/jwt/v5 to v5.2.2 [security] (release-1.17) by @crossplane-renovate in #6354

Full Changelog: v1.17.5...v1.17.6

The v1.19.0 release is a regular quarterly Crossplane release that is focused on maturing a number of key areas of functionality across the project, as Crossplane continues to become more capable, more reliable, and more performant for your production workloads.

🚨 Notable Changes

• The Usage API was promoted to Beta and is now enabled by default.
• Claim server side apply has been promoted to Beta and is now enabled by default.
  • This fixes numerous issues associated with updating a claim and having the update propagate correctly to the corresponding composite resource. These issues can be summarized as:
    • Patches would never remove a field from an object; they were only additive.
    • Arrays were always replaced, not merged, so existing entries in arrays could be overwritten.
  • We expect the vast majority of users to benefit from this change, but there is a slight possibility of impact to users of claims if they were actually relying on this previous buggy/incorrect behavior.

🎉 Highlights

• The Ports that Crossplane uses can now be customized, enabling Crossplane to run in HostNetwork scenarios, such as an AWS EKS cluster with the Calico CNI.
• The Alpha automatic dependency management feature from v1.18 has been augmented with an optional ability to also automatically downgrade packages if needed to meet version constraints.
• The Crossplane CLI commands such as render and validate that download Crossplane packages now work well with private repositories.
• An API promotion policy is now defined and a contributor guide has been written to help Crossplane contributors always safely promote APIs in the project.

🏅 Release MVP

The "Release MVP" for this v1.19.0 release of Crossplane is @Argannor! They contributed the "configurable ports" feature that is critical to get Crossplane and its providers working with managed Kubernetes instances where the control plane is on a separate network from the worker nodes. The community has been requesting this functionality for a long time and @Argannor implemented a very thorough and diligent design, and had the patience to go through a number of iterations and reviews before landing on the final feature. Thank you very much for your patience, thoroughness, and contributing an awesome feature for the Crossplane community @Argannor! 🙇‍♂️ 🙌

📖 Full Changelog

• fix(crank): convert pipeline-composition skip if no environment defined at all by @phisco in #6033
• feat(pkg-mgr): Add condition to lock object by @ezgidemirel in #6031
• feat(xfn): Consider composite ready state in function response by @MisterMX in #6021
• Bump crossplane runtime to v1.19.0-rc.0 by @turkenh in #6036
• Add release-1.18 to renovate base branches by @turkenh in #6040
• fix(deps): update module github.com/docker/docker to v27.1.1+incompatible [security] (main) by @crossplane-renovate in #6045
• added the option to name docker container for functions and reuse them. by @TheBelgarion in #5878
• chore(deps): update module github.com/open-policy-agent/opa to v0.68.0 [security] (main) by @crossplane-renovate in #6044
• fix(crank): beta validate properly pulling crossplane image by @phisco in #6053
• Have the resolver (Lock) controller watch package revisions by @negz in #6054
• Fix unknown fields warnings by @turkenh in #6064
• chore(deps): update module github.com/golang-jwt/jwt/v4 to v4.5.1 [security] (main) by @crossplane-renovate in #6066
• Update releases table and base branches by @turkenh in #6072
• chore(earthly): Pass Crossplane args to hack command by @ezgidemirel in #6088
• render: validate compositeTypeRef matches XR type by @omerap12 in #6058
• fix(crank): add function as input for extensions in cli for validate by @haarchri in #6087
• fix(e2e): install prior version to upgrade fixing lifecycle tests on older branches by @turkenh in #6089
• fix downloading all schemas for validation by @samuelstadler in #6097
• chore(deps): update actions/checkout digest to 11bd719 (main) by @crossplane-renovate in #6055
• chore(deps): update github/codeql-action digest to 396bb3e (main) by @crossplane-renovate in #6056
• chore(deps): update aquasecurity/trivy-action action to v0.28.0 (main) by @crossplane-renovate in #6101
• chore(deps): update renovatebot/github-action action to v41 (main) by @crossplane-renovate in #6102
• chore(deps): update gcr.io/distroless/static docker digest to f4a57e8 (main) by @crossplane-renovate in #6063
• chore(deps): update dependency earthly/earthly to v0.8.15 (main) by @crossplane-renovate in #6060
• chore(config): migrate renovate config by @crossplane-renovate in #6109
• chore(deps): update mheap/require-checklist-action digest to efef3b1 (main) by @crossplane-renovate in #6059
• chore(deps): update actions/checkout action to v4.2.2 (main) by @crossplane-renovate in #6104
• chore(deps): update dependency helm/helm to v3.16.3 (main) by @crossplane-renovate in #6106
• chore(deps): update dependency kubernetes-sigs/kind to v0.25.0 (main) by @crossplane-renovate in #6107
• chore(deps): update dependency golangci/golangci-lint to v1.62.0 (main) by @crossplane-renovate in #6111
• chore: fix wrong comment by @phisco in #6115
• chore(test): Disable renovate on dependency upgrade test manifests by @ezgidemirel in #6116
• chore(deps): update dependency norwoodj/helm-docs to v1.14.2 (main) by @crossplane-renovate in #6112
• chore(deps): update dependency github/codeql-action to v2.19.3 (main) by @crossplane-renovate in #6110
• tests: ignore also image-configs manifests from renovate by @phisco in #6117
• chore(deps): update e2e-manifests (main) by @crossplane-renovate in #6113
• chore(deps): update github/codeql-action digest to ea9e4e3 (main) by @crossplane-renovate in #6123
• Add Alauda to ADOPTERS by @tossmilestone in #6134
• Use kong stdout consistently by @recht in #6142
• Wait for functions to become ready by @negz in #6125
• chore(deps): update renovatebot/github-action action to v41.0.4 (main) by @crossplane-renovate in #6126
• chore(deps): update renovatebot/github-action action to v41.0.5 (main) by @crossplane-renovate in #6147
• Crossplane Helm chart service account creation flag by @rpolansky in #5870
• chore(deps): update dependency golangci/golangci-lint to v1.62.2 (main) by @crossplane-renovate in #6150
• chore(deps): update dependency golang to v1.23.3 (main) by @crossplane-renovate in #6105
• fix: fixed the token-permission and pinned-dependencies by @harshitasao in #5891
• chore(deps): update aquasecurity/trivy-action action to v0.29.0 (main) by @crossplane-renovate in #6151
• chore(deps): update gcr.io/distroless/static docker digest to 5c7e2b4 (main) by @crossplane-renovate in #6149
• e2e: cover downgrades in the lifecycle test case by @turkenh in #6160
• fix(environmentConfigs): revert to v1alpha1 as storageversion to fix rollback issues by @phisco in #6157
• Usages: decomposed usages should be deleted properly by @turkenh in #6155
• chore(deps): update dependency golang to v1.23.4 (main) by @crossplane-renovate in #6154
• chore(deps): update github/codeql-action digest to aa57810 (main) by @crossplane-renovate in #6153
• crank render: fix XR matchLabels validation in composition by @omerap12 in #6080
• chore(deps): updat...

This is a patch release scoped to fixing issues reported by users of Crossplane v1.18 and fixing security related issues in Crossplane's dependencies.

What's Changed

• fix(deps): update module golang.org/x/net to v0.33.0 [security] (release-1.18) by @crossplane-renovate in #6194
• fix(deps): update module github.com/go-git/go-git/v5 to v5.13.0 [security] (release-1.18) by @crossplane-renovate in #6218
• [Backport release-1.18] Use an uncached client to retrieve composed resources not found in the cache by @github-actions in #6276

Full Changelog: v1.18.2...v1.18.3

This is a patch release scoped to fixing issues reported by users of Crossplane v1.17 and fixing security related issues in Crossplane's dependencies.

What's Changed

• fix(deps): update module golang.org/x/net to v0.33.0 [security] (release-1.17) by @crossplane-renovate in #6193
• fix(deps): update module github.com/go-git/go-git/v5 to v5.13.0 [security] (release-1.17) by @crossplane-renovate in #6217

Full Changelog: v1.17.4...v1.17.5

❗ Important

Crossplane version v1.19.0-rc.1 is a release candidate intended to collect input from the community and offer users an opportunity to experiment with Crossplane in non-production environments before the official release of version v1.19.0.

To install Crossplane with this release:

helm repo add crossplane-stable https://charts.crossplane.io/stable --force-update
helm install crossplane --namespace crossplane-system --create-namespace crossplane-stable/crossplane --devel

To install the Crossplane CLI with this release:

curl -sL https://raw.githubusercontent.com/crossplane/crossplane/v1.19.0-rc.1/install.sh | XP_VERSION=v1.19.0-rc.1 sh

🚨 Notable Changes

• The Usage API was promoted to Beta and is now enabled by default.
• Claim server side apply has been promoted to Beta and is now enabled by default.
  • This fixes numerous issues associated with updating a claim and having the update propagate correctly to the corresponding composite resource. These issues can be summarized as:
    • Patches would never remove a field from an object; they were only additive.
    • Arrays were always replaced, not merged, so existing entries in arrays could be overwritten.
  • We expect the vast majority of users to benefit from this change, but there is a slight possibility of impact to users of claims if they were actually relying on this previous buggy/incorrect behavior.

🎉 Highlights

• The Ports that Crossplane uses can now be customized, enabling Crossplane to run in HostNetwork scenarios, such as an AWS EKS cluster with the Calico CNI.
• The Alpha automatic dependency management feature from v1.18 has been augmented with an optional ability to also automatically downgrade packages if needed to meet version constraints.
• The Crossplane CLI commands such as render and validate that download Crossplane packages now work well with private repositories.
• An API promotion policy is now defined and a contributor guide has been written to help Crossplane contributors always safely promote APIs in the project.

📖 Full Changelog

• fix(crank): convert pipeline-composition skip if no environment defined at all by @phisco in #6033
• feat(pkg-mgr): Add condition to lock object by @ezgidemirel in #6031
• feat(xfn): Consider composite ready state in function response by @MisterMX in #6021
• Bump crossplane runtime to v1.19.0-rc.0 by @turkenh in #6036
• Add release-1.18 to renovate base branches by @turkenh in #6040
• fix(deps): update module github.com/docker/docker to v27.1.1+incompatible [security] (main) by @crossplane-renovate in #6045
• added the option to name docker container for functions and reuse them. by @TheBelgarion in #5878
• chore(deps): update module github.com/open-policy-agent/opa to v0.68.0 [security] (main) by @crossplane-renovate in #6044
• fix(crank): beta validate properly pulling crossplane image by @phisco in #6053
• Have the resolver (Lock) controller watch package revisions by @negz in #6054
• Fix unknown fields warnings by @turkenh in #6064
• chore(deps): update module github.com/golang-jwt/jwt/v4 to v4.5.1 [security] (main) by @crossplane-renovate in #6066
• Update releases table and base branches by @turkenh in #6072
• chore(earthly): Pass Crossplane args to hack command by @ezgidemirel in #6088
• render: validate compositeTypeRef matches XR type by @omerap12 in #6058
• fix(crank): add function as input for extensions in cli for validate by @haarchri in #6087
• fix(e2e): install prior version to upgrade fixing lifecycle tests on older branches by @turkenh in #6089
• fix downloading all schemas for validation by @samuelstadler in #6097
• chore(deps): update actions/checkout digest to 11bd719 (main) by @crossplane-renovate in #6055
• chore(deps): update github/codeql-action digest to 396bb3e (main) by @crossplane-renovate in #6056
• chore(deps): update aquasecurity/trivy-action action to v0.28.0 (main) by @crossplane-renovate in #6101
• chore(deps): update renovatebot/github-action action to v41 (main) by @crossplane-renovate in #6102
• chore(deps): update gcr.io/distroless/static docker digest to f4a57e8 (main) by @crossplane-renovate in #6063
• chore(deps): update dependency earthly/earthly to v0.8.15 (main) by @crossplane-renovate in #6060
• chore(config): migrate renovate config by @crossplane-renovate in #6109
• chore(deps): update mheap/require-checklist-action digest to efef3b1 (main) by @crossplane-renovate in #6059
• chore(deps): update actions/checkout action to v4.2.2 (main) by @crossplane-renovate in #6104
• chore(deps): update dependency helm/helm to v3.16.3 (main) by @crossplane-renovate in #6106
• chore(deps): update dependency kubernetes-sigs/kind to v0.25.0 (main) by @crossplane-renovate in #6107
• chore(deps): update dependency golangci/golangci-lint to v1.62.0 (main) by @crossplane-renovate in #6111
• chore: fix wrong comment by @phisco in #6115
• chore(test): Disable renovate on dependency upgrade test manifests by @ezgidemirel in #6116
• chore(deps): update dependency norwoodj/helm-docs to v1.14.2 (main) by @crossplane-renovate in #6112
• chore(deps): update dependency github/codeql-action to v2.19.3 (main) by @crossplane-renovate in #6110
• tests: ignore also image-configs manifests from renovate by @phisco in #6117
• chore(deps): update e2e-manifests (main) by @crossplane-renovate in #6113
• chore(deps): update github/codeql-action digest to ea9e4e3 (main) by @crossplane-renovate in #6123
• Add Alauda to ADOPTERS by @tossmilestone in #6134
• Use kong stdout consistently by @recht in #6142
• Wait for functions to become ready by @negz in #6125
• chore(deps): update renovatebot/github-action action to v41.0.4 (main) by @crossplane-renovate in #6126
• chore(deps): update renovatebot/github-action action to v41.0.5 (main) by @crossplane-renovate in #6147
• Crossplane Helm chart service account creation flag by @rpolansky in #5870
• chore(deps): update dependency golangci/golangci-lint to v1.62.2 (main) by @crossplane-renovate in #6150
• chore(deps): update dependency golang to v1.23.3 (main) by @crossplane-renovate in #6105
• fix: fixed the token-permission and pinned-dependencies by @harshitasao in #5891
• chore(deps): update aquasecurity/trivy-action action to v0.29.0 (main) by @crossplane-renovate in #6151
• chore(deps): update gcr.io/distroless/static docker digest to 5c7e2b4 (main) by @crossplane-renovate in #6149
• e2e: cover downgrades in the lifecycle test case by @turkenh in #6160
• fix(environmentConfigs): revert to v1alpha1 as storageversion to fix rollback issues by @phisco in #6157
• Usages: decomposed usages should be deleted properly by @turkenh in #6155
• chore(deps): update dependency golang to v1.23.4 (main) by @crossplane-renovate in #6154
• chore(deps): update github/codeql-action digest to aa57810 (main) by @crossplane-renovate in #6153
• crank render: fix XR matchLabels validation in composition by @omerap12 in #6080
• chore(deps): update renovatebot/github-action action to v41.0.6 (main) by @crossplane-renovate in #6171
• chore(deps): update github/codeql-action digest to babb554 (main) by @CrossPL...

This is a patch release scoped to fixing issues reported by users of Crossplane v1.17 and fixing security related issues in Crossplane's dependencies.

Users of v1.18.x reported that they were no longer able to downgrade a Crossplane installation from v1.18.x to a previous v1.17.x version. This was fixed in #6157 and we expect downgrades from v1.18.2 to be working once again.

The way Usage objects are managed within a Composition has been updated in #6155 to prevent orphaned Usage objects from remaining in the control plane when a Composition that creates a Usage is updated. The change is described below:

• When the Usage itself deleted, the usage controller will wait for using resource before removing the finalizer, only if the Usage is part of a composite (i.e has crossplane.io/composite label).
• When a resource removed from a composition (i.e. decomposed), the composition controllers (both PT and function) will remove the composed resource labels before deleting the resource.
• This behavior is visually summarized in #5880 (comment)

What's Changed

• [Backport release-1.18] fix(environmentConfigs): revert to v1alpha1 as storageversion to fix rollback issues by @github-actions in #6168
• [Backport release-1.18] Usages: decomposed usages should be deleted properly by @github-actions in #6169
• chore(deps): update module golang.org/x/crypto to v0.31.0 [security] (release-1.18) by @crossplane-renovate in #6180

Full Changelog: v1.18.1...v1.18.2

This is a patch release scoped to fixing security related issues in Crossplane's dependencies, as well as improving E2E test reliability.

What's Changed

• [release-1.17] fix(e2e): install prior version to upgrade fixing lifecycle tests on older branches by @turkenh in #6093
• chore(deps): update module golang.org/x/crypto to v0.31.0 [security] (release-1.17) by @crossplane-renovate in #6179

Full Changelog: v1.17.3...v1.17.4